x509 0.1

Description

This is probably the most complete parser of X.509 certificates in python.

Code is in alpha stage! Don’t use for anything sensitive. I wrote it (based on previous work of colleagues) since there is no comprehensive python parser for X.509 certificates. Often python programmers had to parse openssl output.

Dependencies

• pyasn1 >= 0.1.7

Installation

Install with pip:

pip install py3x509

License

LGPL v2 or later.

See LICENSE.txt.

Known bugs and quirks

• Subject alternative name doesn’t show all subtypes, but ‘DNS’, ‘dirName’ and ‘email’ are supported.

• Name constraints don’t distinguish among various GeneralName subtypes

• Some extensions are not shown very nicely when put in string format

• Not all extensions are supported

• String types accepted for various RDN subelements are rather too permissive

• RDN string conversion does not conform to RFC 4514

• Badly formed extensions are ignored if not marked critical

  • easy to switch to more strict behavior

  • other clients do this as well; RFC 5280 specifies behavior for unknown elements in extensions in appendix B.1, but does not cover all cases (e.g. element exists, but with string type different from spec)

TODO

• Cleanup: This module has it’s own pyasn1 models. Look if we can reuse the pyasn1_modules.rfc2459 X509 cert model.

• Cleanup: Currently, the signature verifier does not work.